I simply added a firewall rule that dropped her traffic, and brought the laptop back to my office for "service." Once the drive was imaged, I erased the rule and made up a story about a network driver update for her model causing the problem.